Oracle REST Data Services CVE-2026-46843

No special conditions are required beyond network reachability - this is remote unauthenticated exploitation against default configurations of Oracle REST Data Services versions 24.2.0 through 26.1.0 (CVSS: AV:N/AC:L/PR:N/UI:N). Any ORDS instance in the affected version range reachable over HTTPS is vulnerable. Limiting factors include: (1) impact is bounded to partial availability degradation only - complete outage, data access, or code execution are not achievable via this CVE alone; (2) ORDS deployments restricted to internal networks or protected behind a firewall/WAF with IP allowlisting cannot be reached by external attackers; (3) no Oracle Database credential or ORDS administrative access is required or leveraged, confirming this is a pure network-layer availability issue.

The CVSS 3.1 Base Score of 5.3 (Medium) reflects a realistic but bounded risk: the attack vector is network (AV:N), complexity is low (AC:L), no privileges are required (PR:N), and no user interaction is needed (UI:N), meaning any internet- or intranet-exposed ORDS instance in the affected version range can be reached and triggered without setup overhead. However, the scope is unchanged (S:U) and the impact ceiling is partial availability degradation (A:L) only - complete service outage, data exfiltration, and integrity compromise are not in scope for this CVE. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified. No CISA KEV listing exists, and no POC has been identified, indicating no confirmed or widespread active exploitation. SSVC signals point to 'Track' rather than 'Act' for most organizations: exploitation is not confirmed, technical impact is partial, but automatable reachability elevates priority for publicly exposed ORDS deployments. The primary real-world concern is that ORDS is often an internet-facing API gateway, which increases the realistic attacker population substantially compared to internal-only services.

An unauthenticated external attacker identifies a publicly accessible Oracle REST Data Services endpoint (common in Oracle Cloud, APEX, or on-premise database API deployments) running a version between 24.2.0 and 26.1.0. The attacker sends a crafted HTTPS request to the Core component - requiring no credentials and no prior access - triggering anomalous resource consumption or processing failure that partially degrades ORDS availability for legitimate users. No public proof-of-concept code has been identified at time of analysis, so the exact request structure is not confirmed.